File ipxe-efi-fix-uninitialised-data-in-HII.patch of Package qemu

Overview Repositories Revisions Requests Users Attributes Meta

File ipxe-efi-fix-uninitialised-data-in-HII.patch of Package qemu (Revision b3447d8baef86f9f0f12c337200facc9)

Currently displaying revision b3447d8baef86f9f0f12c337200facc9 , Show latest

From c9f6a8605955926017cdbe2fa99a4b72fd0985a2 Mon Sep 17 00:00:00 2001
From: Michael Brown <mcb30@ipxe.org>
Date: Wed, 29 Jun 2016 15:13:35 +0100
Subject: [PATCH] [efi] Fix uninitialised data in HII IFR structures

The HII IFR structures are allocated via realloc() rather than
zalloc(), and so are not automatically zeroed.  This results in the
presence of uninitialised and invalid data, causing crashes elsewhere
in the UEFI firmware.

Fix by explicitly zeroing the newly allocated portion of any IFR
structure in efi_ifr_op().

Debugged-by: Laszlo Ersek <lersek@redhat.com>
Debugged-by: Gary Lin <glin@suse.com>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
---
 src/interface/efi/efi_hii.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/interface/efi/efi_hii.c b/src/interface/efi/efi_hii.c
index 0ea970e..506fc88 100644
--- a/src/interface/efi/efi_hii.c
+++ b/src/interface/efi/efi_hii.c
@@ -117,6 +117,7 @@ static void * efi_ifr_op ( struct efi_ifr_builder *ifr, unsigned int opcode,
 	ifr->ops_len = new_ops_len;
 
 	/* Fill in opcode header */
+	memset ( op, 0, len );
 	op->OpCode = opcode;
 	op->Length = len;
 
-- 
2.8.4

Places

File ipxe-efi-fix-uninitialised-data-in-HII.patch of Package qemu (Revision b3447d8baef86f9f0f12c337200facc9)

Places